On 12.03.2010 03:27, netfilter-owner@xxxxxxxxxxxxxxx wrote: > --- On Wed, 3/10/10, Robert Nichols <rnicholsNOSPAM@xxxxxxxxxxx> wrote: > > :- >>> >>> iptables ..... -m bootp --mac-source >> 00:08:a1:ab:75:d1 -j DROP ? >>> >>> Well, if 'iptables' can't serve the purpose, how about >> ebtables ? >> >> Wouldn't it be a lot easier to adjust the DHCP server's >> configuration by >> adding a "deny" statement in the pool's permit list? >> > > True but manually editing the configuration file will require the dhcp server to be restarted, whereas 'iptables' and/or 'ebtables' can be scripted at runtime. > > Cheers. > most likely the dhcp server should have a 'reload' parameter? actually adding/inserting/deleting iptables rules does just the same (as a service restart). the whole ruleset inside the kernel gets reloaded for every single 'runtime' command you place. that is why there is iptables-restore, which loads all rules at once. Best regards Mart -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
